ServerTokens ProductOnly
ServerRoot "/etc/httpd"
PidFile run/httpd.pid
Timeout 120
KeepAlive On
MaxKeepAliveRequests 500
KeepAliveTimeout 15

Listen <IP_ADDRESS>:443

User apache
Group apache
ServerAdmin root@localhost
ServerName <HOSTNAME>
UseCanonicalName Off
HostnameLookups Off
ServerSignature On
LogLevel warn
DirectoryIndex index.html index.html.var
TypesConfig /etc/mime.types
DocumentRoot "/var/www/html"
#include /etc/httpd/conf.d/ssl.conf

Include conf.modules.d/*.conf
LoadModule setenvif_module		modules/mod_setenvif.so
LoadModule mime_module			modules/mod_mime.so
LoadModule dir_module			modules/mod_dir.so
LoadModule alias_module			modules/mod_alias.so
LoadModule log_config_module		modules/mod_log_config.so
LoadModule proxy_module			modules/mod_proxy.so
#LoadModule proxy_ajp_module		modules/mod_proxy_ajp.so
#LoadModule proxy_balancer_module	modules/mod_proxy_balancer.so
LoadModule proxy_connect_module		modules/mod_proxy_connect.so
LoadModule proxy_http_module		modules/mod_proxy_http.so
LoadModule ssl_module			modules/mod_ssl.so
LoadModule authz_host_module		modules/mod_authz_host.so
LoadModule status_module		modules/mod_status.so
#LoadModule deflate_module		modules/mod_deflate.so
LoadModule headers_module		modules/mod_headers.so
LoadModule expires_module		modules/mod_expires.so

<Directory />
    AllowOverride none
    Require all denied
</Directory>

<Directory "/var/www/html">
    Options Indexes FollowSymLinks
    AllowOverride None
    Require all granted
</Directory>

<Files ".ht*">
    Require all denied
</Files>

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%h %l %u %t \"%r\" %>s %b" common
LogFormat "%{Referer}i -> %U" referer
LogFormat "%{User-agent}i" agent
CustomLog logs/access_log combined
ErrorLog "logs/error_log"
Alias /error/ "/var/www/error/"

AddType application/x-compress .Z
AddType application/x-gzip .gz .tgz
AddHandler type-map var
AddType text/html .shtml
AddOutputFilter INCLUDES .shtml

BrowserMatch "Mozilla/2" nokeepalive
BrowserMatch "MSIE 4\.0b2;" nokeepalive downgrade-1.0 force-response-1.0
BrowserMatch "RealPlayer 4\.0" force-response-1.0
BrowserMatch "Java/1\.0" force-response-1.0
BrowserMatch "JDK/1\.0" force-response-1.0
BrowserMatch "Microsoft Data Access Internet Publishing Provider" redirect-carefully
BrowserMatch "MS FrontPage" redirect-carefully
BrowserMatch "^WebDrive" redirect-carefully
BrowserMatch "^WebDAVFS/1.[0123]" redirect-carefully
BrowserMatch "^gnome-vfs/1.0" redirect-carefully
BrowserMatch "^XML Spy" redirect-carefully
BrowserMatch "^Dreamweaver-WebDAV-SCM1" redirect-carefully

AddType image/svg+xml svg svgz
AddEncoding gzip svgz

<IfModule ssl_module>
	SSLRandomSeed startup builtin
	SSLRandomSeed connect builtin
</IfModule>
<IfModule mime_magic_module>
    MIMEMagicFile conf/magic
</IfModule>

<IfModule alias_module>
    ScriptAlias /cgi-bin/ "/var/www/cgi-bin/"
</IfModule>
<Directory "/var/www/cgi-bin">
   AllowOverride None
   Options None
    Require all granted
</Directory>

<IfModule mod_deflate.c>
          # these are known to be safe with MSIE 6
          AddOutputFilterByType DEFLATE text/html text/plain text/xml

          # everything else may cause problems with MSIE 6
          AddOutputFilterByType DEFLATE text/css text/js text/javascript
          AddOutputFilterByType DEFLATE application/x-javascript application/javascript application/ecmascript
          AddOutputFilterByType DEFLATE application/rss+xml
          AddOutputFilterByType DEFLATE application/json
	  SetEnvIfNoCase Request_URI .(?:gif|jpe?g|png)$ no-gzip dont-vary
</IfModule>

<LocationMatch \.(nocache\.js)$>
     Header append Cache-Control "no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0, proxy-revalidate"
</LocationMatch>
                                  
<LocationMatch \.(nocache\.html)$>
    Header append Cache-Control "no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0, proxy-revalidate"
</LocationMatch>

<LocationMatch "\.cache\.(js|html)$">
       ExpiresActive on
       ExpiresByType text/js "access plus 1 years"
       ExpiresByType text/javascript "access plus 1 years"
       ExpiresByType application/javascript "access plus 1 years"
       ExpiresByType application/x-javascript "access plus 1 years"
       ExpiresByType text/html "access plus 1 years"

       # Remove cache-control headers (use default client behavior)
       Header unset Cache-Control:

       # Remove host's default 'Vary: User-Agent' response header
       Header unset Vary:

       Header unset Last-Modified:
       #Header add Cache-Control public
</LocationMatch>

SSLEngine on
SSLProtocol -ALL +TLSv1 +TLSv1.1 +TLSv1.2
SSLCertificateKeyFile /etc/httpd/ssl/server.key
SSLCertificateFile /etc/httpd/ssl/server.crt
SSLCipherSuite ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:!RC4:!DES:!3DES

RewriteEngine on
RewriteCond %{REQUEST_METHOD} ^TRACE
RewriteRule .* - [F]
RewriteCond %{REQUEST_METHOD} ^TRACK
RewriteRule .* - [F]

Header always append X-Frame-Options SAMEORIGIN
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
Header always set X-XSS-Protection "1; mode=block"
#Header always set X-Content-Type-Options nosniff
Header edit Location ^http://(.*)$ https://$1

SSLProxyEngine on
SSLProxyVerify none
SSLProxyCheckPeerCN off
SSLProxyCheckPeerName off
SSLProxyCheckPeerExpire off

ProxyPass /<APP_NAME>/ https://<IP_ADDRESS>:<PORT>/<APP_NAME>/ 
ProxyPass /<APP_NAME> https://<IP_ADDRESS>:<PORT>/<APP_NAME> 
ProxyPassReverse /<APP_NAME> https://<IP_ADDRESS>:<PORT>/<APP_NAME>
ProxyPassReverse /<APP_NAME>/ https://<IP_ADDRESS>:<PORT>/<APP_NAME>/
ProxyPassReverseCookieDomain <IP_ADDRESS> <DNS_URL>